filter f_messages {
level(warn..emerg)
@include "/etc/syslog-ng/patterndb.d/include/not2msg/"
@include "/usr/local/etc/syslog-ng/patterndb.d/include/not2msg/"
};
destination messages { file("/var/log/messages"); };
log {
  source(src);
  filter(f_messages);
  if {
    filter(f_have_monotonic_timestamp);
    rewrite(r_add_monotonic_timestamp);
  };
  destination(messages);
};